2

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:

\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\x85
\xC9\x75\x08\x8D\x41\x2B\x48\x83\xC4\x28
\xC3\x4C

Can I find the function with that pattern using IDA or x64dbg?

Improve this question
2
  • Using IDA, do you mean the IDA debugger? (asking since the second software is a debugger)
    – zi0Black
    Dec 20, 2021 at 14:52
  • @zi0Black Yes - at least I think I'm not 100% sure about the name
    – CoolNite
    Dec 20, 2021 at 17:56

1 Answer 1

Reset to default
2

In IDA, you can find sequences of bytes via Search->Sequence of bytes. That said, if your byte pattern is poorly-chosen (for reasons such as that it includes relocatable byte sequences, or it was created for a different version of the software), the result of the search may well be that the pattern cannot be found in the target binary.

Improve this answer
2
  • Thanks for the answer! It didn't really work but that's more of a problem on my side that I'll figure out. Not your fault at all. Thanks again for answering
    – CoolNite
    Dec 20, 2021 at 18:24
  • No problem. If it doesn't match, try "reducing" your pattern, i.e., selecting some subset of it, and seeing if you can match the smaller one. Try to choose a long sequence that doesn't include any bytes that are interpreted as offsets or displacements.
    – Rolf Rolles
    Dec 20, 2021 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.